6

Let's take an example, let's assume that I would allow only outgoing HTTP[S] traffic to pass through the firewall. I know I would also need to allow outgoing DNS traffic in a real world scenario, but this is just an example. I would have written the iptable rules like this:

:INPUT DROP
:FORWARD DROP
:OUTPUT DROP

-A INPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Is this correct? I wonder because I have seen people who have written the same firewall rules like this:

:INPUT DROP
:FORWARD DROP
:OUTPUT DROP

-A INPUT -p tcp -m multiport --sports 80,443 -m state --state ESTABLISHED,RELATED -j ACCEPT
-A OUTPUT -p tcp -m multiport --dports 80,443 -m state --state NEW -j ACCEPT

What is the difference between NEW and NEW,ESTABLISHED,RELATED for an outgoing rule? Is it enough just to write NEW and let the firewall do some mysterious magic? Or is it necessary to write NEW,ESTABLISHED,RELATED?

migrated from security.stackexchange.com Jul 13 '15 at 19:05

This question came from our site for information security professionals.

  • As a note, the line is most commonly written this way: -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT. This change essentially turns iptables into a stateful firewall. Instead of having to define each TCP connection properly, this line essentially allows all traffic that has already been processed (and allowed) by iptables. – prateek61 Jun 28 '16 at 2:44
3

The second configuration will not work (try it!). Since your default policy is DROP on the OUTPUT chain, the third packet of the TCP three-way-handshake will be blocked by the firewall, as that one does not fall under NEW, so the connection will never be established.

It would work if your default OUTPUT policy would be ACCEPT, or you had some other OUTPUT rule afterwards which would allow ESTABLISHED and RELATED state.

In conclusion, the first ruleset is the correct one, if you want to have DROP as your default policy.

  • Thanks for the answer. That was what I thought, but i got a little bit confused when I saw someone write it with only NEW. I thought maybe IPtables creates some sort of records of established connection, and it was then unecessary to use ESTABLISHED. – BufferOverflow Jul 14 '15 at 13:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.